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IN THE CLAIMS 

1 . (Currently amended) A method for monitoring data values in an event monitoring system, 
using a set of parameters characterizing a reference distribution of the data values, the method 
comprising the steps of: 

computing from a given one of the data values a corresponding probability 
value, utilizing the set of parameters characterizing the reference distribution; 

performing a thresholding operation on the probability value; 

generating alarm information based on the result of the thresholding operation; 

and 

periodically updating the set of parameters to take into account one or more 

of the data values; 

wherein the probability value corresponding to the given one of the data values 
is the probabilitv of obtaining a data value at least as extreme as that given data value . 

2. (Original) The method of claim 1 wherein the event monitoring system comprises an event 
counter which generates the data values and an event monitor which processes the data values to 
generate the alarm information. 

3. (Original) The method of claim 1 wherein the set of parameters comprises at least a mean 
and a variance for the reference distribution of the data values. 

4. (Original) The method of claim 3 wherein the reference distribution comprises an 
asymmetric distribution. 

5. (Original) The method of claim 4 wherein the asymmetric distribution comprises one of 
a negative binomial distribution, a lognormal distribution and a Poisson distribution. 
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6. (Original) The method of claim 1 wherein the data values are collected and thresholded 
in accordance with a measurement timescale, the set of parameters are updated in accordance with 
a parameter timescale longer in duration than the measurement timescale, and a complete set of the 
parameters is determinable in accordance with a cycle timescale longer in duration than the parameter 
timescale. 

7. (Original) The method of claim 6 wherein the measurement timescale comprises 
approximately one minute, the parameter timescale comprises approximately one hour and the cycle 
timescale comprises approximately one day. 

8. (Original) The method of claim 1 wherein the probability value computed from a given 
data value x comprises at least one of: 

(i) an upper tail probability P[data value > x\\ 

(ii) a lower tail probability P[data value jc]; and 

(iii) a minimum of {P[data value ^ jc], P[data value <^x\}\ 

wherein the probability value is computed using the set of parameters 
characterizing the reference distribution that applies at the time the given data value x is collected. 

9. (Original) The method of claim 1 wherein the set of parameters characterizing the 
reference distribution is determined at least in part by interpolating coefficients over multiple 
parameter timescales. 

10. (Original) The method of claim 1 further comprising the step of periodically monitoring 
validity of the reference distribution. 

1 1 . (Original) The method of claim 10 wherein the validity of the reference distribution is 
monitored by generating a histogram of a plurality of probability values and determining if counts 
associated with a plurality of intervals of the histogram are each approximately the same. 
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12. (Original) The method of claim 1 1 wherein the probability values utilized in generating 
the histogram are corrected for continuity by: 

computing the probability of observing data value x under the reference 
distribution 2iS Px-Pi^Pwl, where and py denote respective lower and upper tail probabilities 
associated with data value x under the reference distribution; 

taking a random draw Z from a uniform distribution on [0, 1]; and 
computing a continuity corrected probability value as = p^r, - Z * . 

13. (Original) The method of claim 1 further comprising the step of determining if the given 
data value is an outlier, and if so modifying the given data value as follows: 

replacing an upper tail outlier with a random draw from the reference 
distribution conditioned to be within a specified upper portion of the distribution, such that the upper 
tail outlier is replaced with another upper tail data value; and 

replacing a lower tail outlier with a random draw from the reference 
distribution conditioned to be within a specified lower portion of the distribution, such that the lower 
tail outlier is replaced with another lower tail data value. 

14. (Original) The method of claim 1 wherein the step of updating the set of parameters 
characterizing the reference distribution further comprises updating a given one of the parameters as 
a weighted average of corresponding parameter values determined over a designated timescale. 

15. (Original) The method of claim 1 further including the step of initializing the set of 
parameters characterizing the reference distribution. 

16. (Original) The method of claim 1 wherein the alarm information further comprises an 
alarm severity measure that indicates the severity of alarm conditions based on multiple-mode error 

' comprising at least error duration and error spread. 
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17. (Original) The method of claim 1 wherein the alarm information further comprises an 
alarm severity measure generated at least in part utilizing at least one of a ratio of multiple probability 
values and a difference of logarithms of probability values. 

18. (Original) The method of claim 1 wherein the alarm information further comprises an 
alarm severity measure 5, and the given data value has a logit transformation Z, for a corresponding 
probability value /?, given by: 



where w denotes a severity weight. 

19. (Currently amended) An apparatus for monitoring data values in an event monitoring 
system, using a set of parameters characterizing a reference distribution of the data values, the 
apparatus comprising: 



associated with the monitoring of the data values, the operations including: 

computing from a given one of the data values a corresponding probability 

value, utilizing the set of parameters characterizing the reference distribution; 

performing a thresholding operation on the probability value; 




and further wherein the alarm severity measure is updated as follows: 



a memory for storing the set of parameters; and 

a processor coupled to the memory and operative to control operations 
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generating alarm information based on the result of the thresholding operation; 

and 

periodically updating the set of parameters to take into account one or more 

of the data values; 

wherein the probability value corresponding to the given one of the data values 
is the probability of obtaining a data value at least as extreme as that given data value . 

20. (Currently amended) An article of manufacture comprising a machine-readable storage 
medium for storing one or more programs for use in monitoring data values in an event monitoring 
system, using a set of parameters characterizing a reference distribution of the data values, wherein 
the one or more programs when executed implement the steps of: 

computing from a given one of the data values a corresponding probability 
value, utilizing the set of parameters characterizing the reference distribution; 

performing a thresholding operation on the probability value; 

generating alarm information based on the result of the thresholding operation; 

and 

periodically updating the set of parameters to take into account one or more 

of the data values; 

wherein the probabilitv value corresponding to the given one of the data values 
is the probabilitv of obtaining a data value at least as extreme as that given data value . 
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